> For the complete documentation index, see [llms.txt](https://docs.cortex.aic.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cortex.aic.io/sources-and-evidence/source-protection.md).

# Source Protection

**Open this area:** In the CORTEX menu, select **Sources & evidence → Source protection**.

Keep true identity separately authorised and review the care, exposure and actual authority for each bounded use.

**Who uses this:** Analyst, Reviewer, Administrator.\
**Open in CORTEX:** `/collection/source-protection`.\
**In-app guide:** `/help?topic=source-protection`.

**Expected result:** An authorised analyst receives a generated reference and reviewed ordinary conditions without private identity, risk or referral details.

## Before you start

* Select the correct workspace and obtain explicit permissions. Private case, identity, policy review and ordinary reference use are separate capabilities.
* Obtain actual custodian, independent safeguarding officer, appointment, qualification and authorisation evidence. Role labels and selected people do not establish lawful authority.
* Review the actual approved UK profile and legacy source-name risks. Existing source names and report custody are not automatically migrated or treated as safe pseudonyms.

## What to do

{% stepper %}
{% step %}

## Find protected cases safely

The catalogue shows only cases in your current protected scope. Enter a case reference and select Search to submit it.

Edited text remains pending while confirmed results stay visible. Previous and Next use the last successful search and the service's HasMore window; no global case total is inferred.

A temporary failure keeps the last confirmed page and create authority visible with a stale warning for retry. Lost access clears protected rows, filter scope, paging and actions immediately.

Searching and paging do not change a retained case.
{% endstep %}

{% step %}

## Register the protected policy

Open Collection, Source protection, then Register protected case.

The four steps show reviewed-profile and specialist-evidence prerequisites, required fields, missing inputs and red or green status.

Enter the responsible unit, named custodian and separate safeguarding officer, duty of care, consent/permitted-use limits and legacy review. Supply actual specialist evidence for both officers and handling within your access.

Choose a reviewed profile, record its adoption impact, review the proposal and enter a 10–2,000 character recording reason.

Continue becomes available when the current step is complete; Back preserves earlier entries. Save the attributed draft for independent approval.

Profile and handling are rechecked on save.
{% endstep %}

{% step %}

## Keep identity separate

Use Protected identity only with separate identity permission.

Record true identity/contact and provenance/proximity at handling that covers the case. Case readers cannot retrieve this payload.

Amendments retain earlier identity revisions and cannot lower its handling.
{% endstep %}

{% step %}

## Approve independently

The named safeguarding officer must be separate from every policy author.

Inspect the actual specialist evidence, record the authority and decision evidence, and set an explicit expiry no later than the specialist evidence.

Amending policy clears approval; suspension or closure stops future reference use.
{% endstep %}

{% step %}

## Propose the exact use

Receive the ordinary intelligence report first; unsolicited receipt still needs no collection task.

From the approved case select Propose bounded use. Check the visible approved-policy prerequisite and follow its case link if needed.

Choose a supported destination workflow, enter its actual record ID and load the current scope. Inspect the derived revision, audience, method and content fingerprint, then enter a purpose of 10–2,000 characters.

The page lists missing required inputs immediately; the service rechecks policy, approved profile, handling and destination on save.

The generated use ID is not yet an approved reference.
{% endstep %}

{% step %}

## Review care and cumulative exposure

The named officer independently records care, exposure, consent and authority assessments.

Inspect every earlier reviewed use and explicitly acknowledge its exact revision.

Approval needs an explicit expiry and minimal ordinary conditions plus evidence that those fields reveal no identity or private risk.

Changed policy, audience, method or detail requires a new proposal; competing decisions require refresh and reconsideration.
{% endstep %}

{% step %}

## Attach the reviewed reference

An authorised report editor uses Attach protected reference and enters the generated use ID supplied through the authorised channel.

Check the minimal current decision and save with a reason.

This appends a report revision, so report evaluation and source-risk review must be refreshed.

Ordinary edits retain the protection reference; fresh projection or release checks the current decision. A sanitised child needs fresh protection review for its own scope.
{% endstep %}

{% step %}

## Record a restricted referral

Record actual safeguarding or source-compromise referrals already made through the authorised channel.

The three steps show required inputs, missing conditions and red or green validation status.

Choose a specialist with currently valid verified evidence; if none are available, review specialist evidence on the policy.

Record the restricted reference, context, actions, actual referral time, future review date and recording reason.

Saving sends no message. Keep identity and allegations out of ordinary alerts and Pulse.
{% endstep %}

{% step %}

## Hand off minimally to Security

Expand the retained referral and choose Record minimal Security handoff.

Review the named recipient, actual time and exact retained reference before recording an assigned incident.

The recipient must already have Security management access to the full case handling. Security receives neutral text and references; private detail remains in Collection behind separate access.

An unchanged retry recovers the same incident. A changed or unavailable profile/access requires review.

No message is sent, and incident resolution never restores source use.
{% endstep %}
{% endstepper %}

## Check the result

* Are identity and ordinary reference permissions separate?
* Are appointments, qualifications and authority evidenced and current?
* Does the exact destination still match?
* Have earlier uses been reviewed for cumulative exposure?
* Are public conditions free of private identity and risk?
* Are expiry and follow-up dates explicit?

## If you get stuck

<details>

<summary>Can an analyst use a source without seeing its identity?</summary>

Yes. Explicit ordinary-use permission and normal report/profile access return only a generated approved reference, public conditions, exact destination and expiry. Private case and identity grants are not required.

</details>

<details>

<summary>Does a legacy source name become a pseudonym?</summary>

No. Historical names, hashes and report custody remain unchanged. An authorised owner must assess legacy exposure and establish a protected case deliberately.

</details>

<details>

<summary>Why did a previously approved reference stop working?</summary>

The policy, source profile, use decision or destination may have changed or expired, or your access may have changed. Ask the authorised officer to review the current scope; do not remove the retained reference or copy private details into ordinary content.

</details>

## Responsibility and limits

* Upgrade grants no new access. Workspace role ceilings do not replace explicit organisational grants.
* Current protected-use support covers report assessment. Product attachment and dissemination of protection-bound reports are blocked until their separate audience/method review workflow is delivered. Unbound historical report workflows remain unchanged.
* Use references are generated independently for each use. Case identifiers, related-use counts, private risk and referrals are excluded from the ordinary projection; no automatic identity merge occurs.
* Each case retains up to 64 revisions, 16 use proposals, eight reviews per use and 16 referrals within four MiB. Identity history has separate 64-revision/four-MiB bounds. A limit never discards history.
* After a conflict, compare the current retained decision before retrying. Policy registration can retry unchanged on the same page. For other lost responses, inspect retained history before resubmitting. Access loss clears sensitive page content.
* Closure and expiry stop fresh use; retained authorised report history remains readable. No identity deletion, blanket legal approval, statutory appointment or automatic notification is performed.
* Actual organisational acceptance, external referral handling and specialist legal decisions remain responsibilities of the authorised owners.

**Reference and scope:** F17 source protection. This records safeguards and external evidence; it does not operate a CHIS system, appoint statutory officers or confer powers.

## Related workflows

* [Record authority before new source use](broken://pages/3ea597edb1748357b6a7dc5c5beba4fb3e2f9c10)
* [Record and review external collection authority](broken://pages/6ee09de85e92ae4a794e9d32bf4823984218f6d6)
* [Receive, evaluate and safely use intelligence reports](broken://pages/5201dc5785253ca4589823f682058c08a830d5f1)
* [Record and manage a defensive security incident](file:///7397340/assurance/security.md)
* [Manage accounts, grants and workspace membership](file:///7397340/assurance/access.md)